Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-11-2024 09:17
Static task
static1
Behavioral task
behavioral1
Sample
2597d299f220ba2dbee04bd903c3962e5a262e0686fab8f4ae581fe928d81c1a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2597d299f220ba2dbee04bd903c3962e5a262e0686fab8f4ae581fe928d81c1a.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Accelerationsbaner.doc
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Accelerationsbaner.doc
Resource
win10v2004-20241007-en
General
-
Target
Accelerationsbaner.doc
-
Size
122KB
-
MD5
4aa4c10ecf80317631b3ac10592d5ba3
-
SHA1
5a99a20551269be3c472ec1e6dfe1d93f79391ea
-
SHA256
84e3b3b94d2a070961b4d7ece917274765f0a725fa4721d2414c9af8162a5d57
-
SHA512
a80cb051591d85b472e1ea32b53dd84b90f3aab718946e5afb56fe63fabb6e7f3a90d93fdef7a003a7aca94b19ad65bd89ec067c4011904f29ab4f7fe24f6fe0
-
SSDEEP
1536:dMYzqdOlEsBsZtdheQVNPpO/HriDX8Xj1DASrI05each6v3:dMYzWOlEesZb0axpqODoASrIvrov3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1324 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
WINWORD.EXEpid process 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE 1324 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Accelerationsbaner.doc"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1324